Some checks were not successful

Do not allow the backing IOSurface to change underneath a NativeSurface.
Mac has been observed to give out two IOSurfaces with the same ID to a
single compositor process, after it allocates the first, hands it to the
paint process, releases its hold on the first, allocates the second,
then hands the second over to the paint process. Doing that sequence,
unsurprisingly, can screw things up royally.
Fixes the Mac-specific bug blocking servo/servo#8641
<!-- Reviewable:start -->
[<img src="https://reviewable.io/review_button.svg" height="40" alt="Review on Reviewable"/>](https://reviewable.io/reviews/servo/rust-layers/228)
<!-- Reviewable:end -->

All checks have passed

Mac has been observed to give out two IOSurfaces with the same ID to a
single compositor process, after it allocates the first, hands it to the
paint process, releases its hold on the first, allocates the second,
then hands the second over to the paint process. Doing that sequence,
unsurprisingly, can screw things up royally.
Fixes the Mac-specific bug blocking servo/servo#8641